palarran-security-code

Topics in the source

• Application code security audit

Start with the task context entry; a small audit uses summary+report with inline decisions. Read only the selected profile method, applicable source rows, shared findings/schema sections, security domain section, compact decision rule and short memory entry. Reuse unchanged context in the same task; do not recursively load every linked guide. /palarran:security:code {scope?} reviews the actual business process and code, with finite scope from current project context when omitted. --plan allows local inspection/inert private planning only, no application/scanner execution, remote/search-provider calls, fixes or installs. Default is readonly source/configuration review and public-source research. A test plan never grants traffic, exploit or mutation permission. 1. Pin revision/dirty snapshot, stack and actual vs unknown runtime identity. Establish actors, tenants, ownership/delegation, sensitive resources, role permissions and allowed lifecycle transitions. If business policy is unclear, ask about that operation rather than inventing an access rule. 2. Follow actual entry points through verified identity, authorization, data access/transactions, side effects and response/cache projec

This is an excerpt. Refer to the complete source and its current requirements.